Archive for October 2026
Cyber Dependencies and Attack Surface: ENISA 2026
The ENISA Threat Landscape 2026, published on 22 September, has a message that gets less attention than the usual list of threats: organisations are increasingly exposed through their cyber dependencies, meaning the technologies, suppliers and services they rely on. For German businesses, that means cyber risk no longer sits only in internal networks and endpoints.…
Read MoreSonicWall SMA1000 SSRF Vulnerability: Third Max Flaw
A third maximum-severity flaw in three months has been fixed in SonicWall’s SMA1000 remote-access appliances, and this SonicWall SMA1000 SSRF vulnerability may already be under attack. SonicWall’s October advisory describes an unauthenticated server-side request forgery rated CVSS 10.0. A security firm says its honeypots saw exploitation attempts, while SonicWall says it has no evidence of…
Read MoreFrench Supermarket Fridge Cyberattack Hits Danfoss
Attackers took control of refrigeration controllers at hundreds of French supermarkets overnight on October 11 to 12 and forced them to heat up, and this French supermarket fridge cyberattack left several chains throwing away stock. Les Mousquetaires, which owns Intermarché, said its fridges and freezers were put into defrost and heated to as much as…
Read MoreGhostAction GitHub Actions Attack Steals Secrets
The GhostAction GitHub Actions attack is back, and its payload now reads a repository’s entire git history. Researchers report that attackers took over two well-known maintainer accounts on October 8 and pushed a workflow called “Security Audit” into 345 repositories within minutes. Rotating your current Actions secrets no longer settles the exposure, because the workflow…
Read MoreFlax Typhoon Integrity Tech Domain Seizure
The Flax Typhoon Integrity Tech case reached a new stage on October 8, when the FBI seized seven domains behind two hacking tools, MicroScan and FishHub. The Justice Department says a Chinese company with government contracts, Integrity Technology Group, operated them. The joint advisory published alongside gives defenders a short list: password spraying against Microsoft…
Read More